Chip and Pin - More secure for who?

- M
- Mike Scott
  
  Contact options for registered users
Vote on answer
posted
19 years ago

Wed, Oct 13, 2004 3:47 PM

Evidently :-)

Update: it turns out that the bank (Natwest - I'll name it now :-)) issues various different Servicecards, and the problem affects all Servicecard 100's, but not Servicecard 250's. I'm just the first to report the problem (fame at last :-) ), and their tech people have finally caught on to what's happening; not that they can offer a fix time yet.

Doesn't say much for their testing (they've obviously assumed because the 250's are ok, so must the 100's be); OTOH their customer service person has been very polite, helpful and perseverant in the face of an apparently intractable problem, so a plus mark there.

- A
- Alex
  
  Contact options for registered users
Vote on answer
posted
19 years ago

Thu, Oct 14, 2004 12:56 PM

Without a hint of irony, Mike Scott astounded uk.finance on 13 Oct

2004 by announcing:

I wouldn't worry about it. There's a load of this goes on; so much so that the terminal vendors, integrators et al are having to modify their applications (and in extreme circumstances, the hardware) because cards have already been issued. e.g. 20,0000 out-of-spec cards in Turkey.

BTW, it's likely that they just muddled the CVM up on your card. Of those CVMs listed in the spec, Online PIN is used by ATMs and is highly unlikely to be used at POS. Offline PIN is the one being used at POS. If they stuck Offline instead of Online PIN on your card, that would explain why your card doesn't work in an ATM but you're asked for PIN in shops. They either should have put Online PIN plus Sig - allowing you to use your card in an ATM - or left it at sig only.

- M
- Mike Scott
  
  Contact options for registered users
Vote on answer
posted
19 years ago

Thu, Oct 14, 2004 4:41 PM

Alex wrote: ...

They're not willing to allow Online + Signature; regrettably it's all or nothing. I wonder if the bank itself doesn't understand the flexibility that seems to be built into the card architecture. Thanks BTW for the implicit clarification about the one and offline modes. The emvco docs were, er, confusing reading when starting from scratch :-)